Ubiquiti fixes five UniFi OS vulnerabilities, three of them critical

Ubiquiti has published Security Advisory Bulletin 064, covering five vulnerabilities across a broad range of UniFi OS devices. Three are rated critical at CVSS 10.0, one is critical at 9.1 and one is rated high at 7.7.

The issues involve improper input validation leading to command injection, improper access control allowing unauthorised system modifications, and path traversal defects permitting unauthorised file and account access. Ubiquiti strongly advises all administrators to update affected devices to the latest patched firmware.

What this means for your business

Ubiquiti network equipment is often deployed in smaller offices, retail sites and locations without local IT, and is therefore rarely updated. When a device that controls the network can be taken over, you lose control of traffic flow at that site, including any ability to rely on segmentation. This is equipment that belongs in ordinary vulnerability management, not treated as furniture.

Berigo recommends

• Update all UniFi OS devices to the latest patched firmware, including at sites without local IT staff.
• Check whether any network equipment management interfaces are reachable from the internet, and close them.
• Add network equipment to the asset inventory with a named owner and a fixed update interval.
• Require your local network supplier to document firmware levels with each delivery.

Source

• community.ui.com
• microsoft.com